Bubblewrap Vulnerabilities and Regression Impact Flatpak Apps on Ubuntu

Ubuntu has disclosed multiple vulnerabilities in Bubblewrap, a core component used for sandboxing applications. These flaws could allow local attackers to bypass sandbox restrictions or trigger denial-of-service conditions. While patches were issued, a subsequent regression has disrupted the functionality of Flatpak applications, prompting a temporary rollback of one fix.

The issues primarily affect systems using Bubblewrap for application isolation, especially Ubuntu 18.04 LTS where CVE-2019-12439 poses a risk. Teams relying on Flatpak should be aware of potential disruptions and monitor for updated fixes that resolve both the original vulnerabilities and the newly introduced regression.

Vulnerability Overview

• CVE-2019-12439 allows local attackers to cause denial of service or execute arbitrary code via improper handling of temporary directories.
• CVE-2026-87766 enables file creation outside the intended sandbox due to incorrect symlink handling during setup.
• Both vulnerabilities impact system integrity and could lead to privilege escalation within sandboxed environments.

Patch and Regression Issues

• USN-8779-1 initially addressed both vulnerabilities but introduced a symlink resolution bug.
• The regression broke compatibility with certain Flatpak applications, preventing them from launching.
• USN-8779-2 reverts the problematic fix for CVE-2026-87766 while maintaining protection against CVE-2019-12439.
• A permanent fix is under development to resolve both security issues without side effects.

Sources

• USN-8779-1: Bubblewrap vulnerabilities
• USN-8779-2: Bubblewrap regression